Security
Your school's data belongs to your school.
Schools hold the most sensitive information about students and families. We built Petek with that in mind: every school's data is separated at the database level, backed up every night, every access tied to a permission and every change on record.
Every school's data separated at the database level
In Petek every record belongs to a school, and row-level security rules in the database limit every query to the signed-in school: one school's session cannot reach another school's records. On the Campus plan your school's records can also be kept in a separate database that belongs to you alone.
Onore licensing center
Plan and module license
Your school
Only its own data
Backed up nightly
School B
Only its own data
Backed up nightly
School C
Only its own data
Backed up nightly
Central licensing
Plan, user and module licenses are managed from Onore's licensing center. The center knows which modules your school may use; your school's records stay not in the center but in the database where school data is kept.
Automatic nightly backups
Every night each school's data is written to a backup of its own. The last 14 nights and 8 weeks are kept. One school can be restored on its own without touching any other school. A second, server-level backup layer runs as well.
Permissions by role, department and branch
Every permission comes with one of four scopes: own records, department, branch or the whole school. A teacher sees their class, accounting sees collections, the owner sees the whole school. Sensitive data such as health, guidance and salary need their own permission. Approvals follow the four-eyes rule: whoever opened a request, or gains from it, cannot decide it.
Audit log
Every change to a record is stored with who made it, when, and what changed. The audit log is append-only at database level: no role in the app can edit or delete an entry. Administrators can review the audit log in the panel.
Authentication
Users sign in with email and password and can turn on two-factor authentication. Sessions are managed on the server.
Encrypted credentials
Keys for integrations such as bank POS, payment providers, WhatsApp, SMS, e-invoicing and e-mail are stored encrypted in the database and never shown as plain text in the interface. Staff salary, IBAN, SGK and ID numbers are also encrypted by the application.
Hosting
All traffic travels over encrypted connections. Schools that want their data to stay in Türkiye can have their database hosted on servers in Türkiye.
KVKK and data export
For the student, parent and staff data a school enters into Petek, the school is the data controller and Petek processes that data on the school's behalf. When a parent or staff member asks for their data, you can export the related records, and you can take all of your school's data as a portable file.
Updates are watched
Every update of the phone app is watched through launch reports from installs; no personal data is collected. If an update's launch problems pass a threshold, our team is alerted and rolls the update back.
Have a question about security?
We can share detailed information with your IT team or legal advisor.